securemark 0.224.0 → 0.224.1

package/CHANGELOG.md

@@ -1,5 +1,9 @@
 # Changelog
 
+## 0.224.1
+
+- Refactoring.
+
 ## 0.224.0
 
 - Change media parser to disallow relative paths.

package/dist/securemark.js

@@ -1,4 +1,4 @@
-/*! securemark v0.224.0 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED */
+/*! securemark v0.224.1 https://github.com/falsandtru/securemark | (c) 2017, falsandtru | UNLICENSED */
 require = function () {
     function r(e, n, t) {
         function o(i, f) {
@@ -215,21 +215,52 @@ require = function () {
         function (_dereq_, module, exports) {
             'use strict';
             Object.defineProperty(exports, '__esModule', { value: true });
-            exports.aggregate = exports.bundle = void 0;
-            function bundle(...as) {
+            exports.compile = exports.aggregate = exports.bundle = void 0;
+            const function_1 = _dereq_('./function');
+            function bundle(...fs) {
                 return function (...bs) {
-                    return as.map((f, i) => f.call(this, bs[i]));
+                    return fs.map((f, i) => f.call(this, bs[i]));
                 };
             }
             exports.bundle = bundle;
-            function aggregate(...as) {
-                return function (b) {
-                    return as.map(f => f.call(this, b));
+            function aggregate(...fs) {
+                return function (a) {
+                    return fs.map(f => f.call(this, a));
                 };
             }
             exports.aggregate = aggregate;
+            function compile(...fs) {
+                return function (a) {
+                    var _a;
+                    const gs = [];
+                    try {
+                        for (let i = 0; i < fs.length; ++i) {
+                            gs.push(fs[i].call(this, a));
+                        }
+                        return (0, function_1.singleton)(() => cancel(gs));
+                    } catch (reason) {
+                        cancel(gs);
+                        throw new Error(`Spica: Arrow: ${ (_a = reason === null || reason === void 0 ? void 0 : reason.toString()) !== null && _a !== void 0 ? _a : reason }`);
+                    }
+                };
+            }
+            exports.compile = compile;
+            function cancel(cancellers) {
+                const reasons = [];
+                for (let i = 0; i < cancellers.length; ++i) {
+                    try {
+                        cancellers[i]();
+                    } catch (reason) {
+                        reasons.push(reason);
+                    }
+                }
+                if (reasons.length > 0) {
+                    throw new AggregateError(reasons);
+                }
+                return;
+            }
         },
-        {}
+        { './function': 16 }
     ],
     8: [
         function (_dereq_, module, exports) {
@@ -835,7 +866,7 @@ require = function () {
             exports.uncurry = uncurry;
             function uncurry_(f) {
                 const arity = f.length;
-                return (...xs) => arity === 0 || xs.length < 2 || xs.length <= arity ? f(...xs) : uncurry_(f(...(0, array_1.shift)(xs, arity)[0]))(...xs);
+                return (...xs) => arity === 0 || xs.length <= arity ? f(...xs) : uncurry_(f(...(0, array_1.shift)(xs, arity)[0]))(...xs);
             }
         },
         { './array': 6 }
@@ -869,9 +900,7 @@ require = function () {
         function (_dereq_, module, exports) {
             'use strict';
             Object.defineProperty(exports, '__esModule', { value: true });
-            exports.run = exports.clear = exports.mapReturn = exports.mapParameters = exports.singleton = void 0;
-            const global_1 = _dereq_('./global');
-            const exception_1 = _dereq_('./exception');
+            exports.clear = exports.singleton = void 0;
             const noop_1 = _dereq_('./noop');
             function singleton(f) {
                 let result;
@@ -884,55 +913,12 @@ require = function () {
                 };
             }
             exports.singleton = singleton;
-            function mapParameters(f, g) {
-                return (...as) => f(...g(...as));
-            }
-            exports.mapParameters = mapParameters;
-            function mapReturn(f, g) {
-                return (...as) => g(f(...as));
-            }
-            exports.mapReturn = mapReturn;
             function clear(f) {
                 return (...as) => void f(...as);
             }
             exports.clear = clear;
-            function run(fs) {
-                const gs = (0, global_1.Array)(fs.length);
-                try {
-                    for (let i = 0; i < fs.length; ++i) {
-                        gs[i] = fs[i]();
-                    }
-                } catch (reason) {
-                    for (let i = 0; gs[i]; ++i) {
-                        try {
-                            gs[i]();
-                        } catch (reason) {
-                            (0, exception_1.causeAsyncException)(reason);
-                        }
-                    }
-                    throw reason;
-                }
-                return singleton(() => {
-                    const rs = [];
-                    for (let i = 0; gs[i]; ++i) {
-                        try {
-                            gs[i]();
-                        } catch (reason) {
-                            rs.push(reason);
-                        }
-                    }
-                    if (rs.length > 0) {
-                        throw new AggregateError(rs);
-                    }
-                });
-            }
-            exports.run = run;
         },
-        {
-            './exception': 14,
-            './global': 17,
-            './noop': 22
-        }
+        { './noop': 22 }
     ],
     17: [
         function (_dereq_, module, exports) {
@@ -2165,7 +2151,7 @@ require = function () {
                         }
                         exports.join = join;
                     },
-                    { './global': 9 }
+                    { './global': 8 }
                 ],
                 6: [
                     function (_dereq_, module, exports) {
@@ -2183,21 +2169,7 @@ require = function () {
                     function (_dereq_, module, exports) {
                         'use strict';
                         Object.defineProperty(exports, '__esModule', { value: true });
-                        exports.causeAsyncException = void 0;
-                        function causeAsyncException(reason) {
-                            void Promise.reject(reason);
-                        }
-                        exports.causeAsyncException = causeAsyncException;
-                    },
-                    {}
-                ],
-                8: [
-                    function (_dereq_, module, exports) {
-                        'use strict';
-                        Object.defineProperty(exports, '__esModule', { value: true });
-                        exports.run = exports.clear = exports.mapReturn = exports.mapParameters = exports.singleton = void 0;
-                        const global_1 = _dereq_('./global');
-                        const exception_1 = _dereq_('./exception');
+                        exports.clear = exports.singleton = void 0;
                         const noop_1 = _dereq_('./noop');
                         function singleton(f) {
                             let result;
@@ -2210,57 +2182,14 @@ require = function () {
                             };
                         }
                         exports.singleton = singleton;
-                        function mapParameters(f, g) {
-                            return (...as) => f(...g(...as));
-                        }
-                        exports.mapParameters = mapParameters;
-                        function mapReturn(f, g) {
-                            return (...as) => g(f(...as));
-                        }
-                        exports.mapReturn = mapReturn;
                         function clear(f) {
                             return (...as) => void f(...as);
                         }
                         exports.clear = clear;
-                        function run(fs) {
-                            const gs = (0, global_1.Array)(fs.length);
-                            try {
-                                for (let i = 0; i < fs.length; ++i) {
-                                    gs[i] = fs[i]();
-                                }
-                            } catch (reason) {
-                                for (let i = 0; gs[i]; ++i) {
-                                    try {
-                                        gs[i]();
-                                    } catch (reason) {
-                                        (0, exception_1.causeAsyncException)(reason);
-                                    }
-                                }
-                                throw reason;
-                            }
-                            return singleton(() => {
-                                const rs = [];
-                                for (let i = 0; gs[i]; ++i) {
-                                    try {
-                                        gs[i]();
-                                    } catch (reason) {
-                                        rs.push(reason);
-                                    }
-                                }
-                                if (rs.length > 0) {
-                                    throw new AggregateError(rs);
-                                }
-                            });
-                        }
-                        exports.run = run;
                     },
-                    {
-                        './exception': 7,
-                        './global': 9,
-                        './noop': 11
-                    }
+                    { './noop': 10 }
                 ],
-                9: [
+                8: [
                     function (_dereq_, module, exports) {
                         'use strict';
                         const global = void 0 || typeof globalThis !== 'undefined' && globalThis || typeof self !== 'undefined' && self || Function('return this')();
@@ -2269,7 +2198,7 @@ require = function () {
                     },
                     {}
                 ],
-                10: [
+                9: [
                     function (_dereq_, module, exports) {
                         'use strict';
                         Object.defineProperty(exports, '__esModule', { value: true });
@@ -2310,10 +2239,10 @@ require = function () {
                     },
                     {
                         './compare': 6,
-                        './global': 9
+                        './global': 8
                     }
                 ],
-                11: [
+                10: [
                     function (_dereq_, module, exports) {
                         'use strict';
                         Object.defineProperty(exports, '__esModule', { value: true });
@@ -2324,7 +2253,7 @@ require = function () {
                     },
                     {}
                 ],
-                12: [
+                11: [
                     function (_dereq_, module, exports) {
                         'use strict';
                         var _a, _b;
@@ -2671,11 +2600,11 @@ require = function () {
                     },
                     {
                         './alias': 4,
-                        './global': 9,
-                        './noop': 11
+                        './global': 8,
+                        './noop': 10
                     }
                 ],
-                13: [
+                12: [
                     function (_dereq_, module, exports) {
                         'use strict';
                         Object.defineProperty(exports, '__esModule', { value: true });
@@ -2757,9 +2686,9 @@ require = function () {
                             }
                         }
                     },
-                    { './global': 9 }
+                    { './global': 8 }
                 ],
-                14: [
+                13: [
                     function (_dereq_, module, exports) {
                         'use strict';
                         Object.defineProperty(exports, '__esModule', { value: true });
@@ -2812,12 +2741,12 @@ require = function () {
                         }
                     },
                     {
-                        './proxy': 15,
-                        './util/dom': 16,
+                        './proxy': 14,
+                        './util/dom': 15,
                         'spica/alias': 4
                     }
                 ],
-                15: [
+                14: [
                     function (_dereq_, module, exports) {
                         'use strict';
                         var _a, _b, _c, _d;
@@ -3121,14 +3050,14 @@ require = function () {
                         }
                     },
                     {
-                        './util/dom': 16,
-                        './util/identity': 17,
+                        './util/dom': 15,
+                        './util/identity': 16,
                         'spica/alias': 4,
                         'spica/array': 5,
-                        'spica/global': 9
+                        'spica/global': 8
                     }
                 ],
-                16: [
+                15: [
                     function (_dereq_, module, exports) {
                         'use strict';
                         Object.defineProperty(exports, '__esModule', { value: true });
@@ -3196,18 +3125,22 @@ require = function () {
                                 case 'function':
                                     if (name.length < 3)
                                         throw new Error(`TypedDOM: Attribute names for event listeners must have an event name but got "${ name }".`);
-                                    if (name.slice(0, 2) !== 'on')
-                                        throw new Error(`TypedDOM: Attribute names for event listeners must start with "on" but got "${ name }".`);
-                                    el.addEventListener(name.slice(2), value, {
-                                        passive: [
-                                            'wheel',
-                                            'mousewheel',
-                                            'touchstart',
-                                            'touchmove',
-                                            'touchend',
-                                            'touchcancel'
-                                        ].includes(name.slice(2))
-                                    });
+                                    const names = name.split(/\s+/);
+                                    for (let i = 0; i < names.length; ++i) {
+                                        const name = names[i];
+                                        if (name.slice(0, 2) !== 'on')
+                                            throw new Error(`TypedDOM: Attribute names for event listeners must start with "on" but got "${ name }".`);
+                                        el.addEventListener(name.slice(2), value, {
+                                            passive: [
+                                                'wheel',
+                                                'mousewheel',
+                                                'touchstart',
+                                                'touchmove',
+                                                'touchend',
+                                                'touchcancel'
+                                            ].includes(name.slice(2))
+                                        });
+                                    }
                                     continue;
                                 case 'object':
                                     el.removeAttribute(name);
@@ -3242,11 +3175,11 @@ require = function () {
                     },
                     {
                         'spica/alias': 4,
-                        'spica/global': 9,
-                        'spica/memoize': 10
+                        'spica/global': 8,
+                        'spica/memoize': 9
                     }
                 ],
-                17: [
+                16: [
                     function (_dereq_, module, exports) {
                         'use strict';
                         var _a;
@@ -3258,11 +3191,11 @@ require = function () {
                         exports.identity = (0, random_1.unique)(random_1.rnd0Z, 2, (_a = global_1.global[ids]) !== null && _a !== void 0 ? _a : global_1.global[ids] = new global_1.Set());
                     },
                     {
-                        'spica/global': 9,
-                        'spica/random': 13
+                        'spica/global': 8,
+                        'spica/random': 12
                     }
                 ],
-                18: [
+                17: [
                     function (_dereq_, module, exports) {
                         'use strict';
                         Object.defineProperty(exports, '__esModule', { value: true });
@@ -3313,12 +3246,12 @@ require = function () {
                         exports.bind = bind;
                     },
                     {
-                        'spica/function': 8,
-                        'spica/noop': 11,
-                        'spica/promise': 12
+                        'spica/function': 7,
+                        'spica/noop': 10,
+                        'spica/promise': 11
                     }
                 ],
-                19: [
+                18: [
                     function (_dereq_, module, exports) {
                         'use strict';
                         Object.defineProperty(exports, '__esModule', { value: true });
@@ -3333,7 +3266,7 @@ require = function () {
                         }
                         exports.apply = apply;
                     },
-                    { './dom': 16 }
+                    { './dom': 15 }
                 ],
                 'typed-dom': [
                     function (_dereq_, module, exports) {
@@ -3475,13 +3408,13 @@ require = function () {
                         });
                     },
                     {
-                        './src/builder': 14,
-                        './src/proxy': 15,
-                        './src/util/dom': 16,
-                        './src/util/identity': 17,
-                        './src/util/listener': 18,
-                        './src/util/query': 19,
-                        'spica/global': 9
+                        './src/builder': 13,
+                        './src/proxy': 14,
+                        './src/util/dom': 15,
+                        './src/util/identity': 16,
+                        './src/util/listener': 17,
+                        './src/util/query': 18,
+                        'spica/global': 8
                     }
                 ]
             }, {}, [
@@ -7735,9 +7668,9 @@ require = function () {
                 switch (uri.protocol) {
                 case 'http:':
                 case 'https:':
-                    if (INSECURE_URI.slice(0, 2) === '^/' && /(?:\/\.\.?)(?:\/|$)/.test(INSECURE_URI.slice(0, INSECURE_URI.search(/[?#]|$/)))) {
+                    if (INSECURE_URI.slice(0, 2) === '^/' && /\/\.\.?(?:\/|$)/.test(INSECURE_URI.slice(0, INSECURE_URI.search(/[?#]|$/)))) {
                         type = 'argument';
-                        description = 'Subresource paths cannot contain dot-segments.';
+                        description = 'Dot-segments cannot be used in subresource paths.';
                         break;
                     }
                     return (0, typed_dom_1.html)('a', {
@@ -7970,12 +7903,12 @@ require = function () {
                 link_1.option
             ]);
             function sanitize(uri, target) {
-                if (/^\.\.?\//.test(uri.source)) {
+                if (/\/\.\.?(?:\/|$)/.test('/' + uri.source.slice(0, uri.source.search(/[?#]|$/)))) {
                     (0, typed_dom_1.define)(target, {
                         class: void target.classList.add('invalid'),
                         'data-invalid-syntax': 'media',
                         'data-invalid-type': 'argument',
-                        'data-invalid-description': 'Relative paths cannot be used with media syntax; Use subresource paths instead.'
+                        'data-invalid-description': 'Dot-segments cannot be used in media paths; use subresource paths instead.'
                     });
                     return false;
                 }

package/package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "securemark",
-  "version": "0.224.0",
+  "version": "0.224.1",
   "lockfileVersion": 1,
   "requires": true,
   "dependencies": {
@@ -522,9 +522,9 @@
       "dev": true
     },
     "@types/dompurify": {
-      "version": "2.3.1",
-      "resolved": "https://registry.npmjs.org/@types/dompurify/-/dompurify-2.3.1.tgz",
-      "integrity": "sha512-YJth9qa0V/E6/XPH1Jq4BC8uCMmO8V1fKWn8PCvuZcAhMn7q0ez9LW6naQT04UZzjFfAPhyRMZmI2a2rbMlEFA==",
+      "version": "2.3.2",
+      "resolved": "https://registry.npmjs.org/@types/dompurify/-/dompurify-2.3.2.tgz",
+      "integrity": "sha512-iht/O0jie/hDur39Z1NzjfOT/O9Kn2aWY99aqOn7lwsjSttEoMyGWvZIuAzZy0cNvAZdjmqySp7Z4d3GfBEGQw==",
       "dev": true,
       "requires": {
         "@types/trusted-types": "*"
@@ -547,9 +547,9 @@
       "dev": true
     },
     "@types/jquery": {
-      "version": "3.5.9",
-      "resolved": "https://registry.npmjs.org/@types/jquery/-/jquery-3.5.9.tgz",
-      "integrity": "sha512-B8pDk+sH/tSv/HKdx6EQER6BfUOb2GtKs0LOmozziS4h7cbe8u/eYySfUAeTwD+J09SqV3man7AMWIA5mgzCBA==",
+      "version": "3.5.10",
+      "resolved": "https://registry.npmjs.org/@types/jquery/-/jquery-3.5.10.tgz",
+      "integrity": "sha512-w2qT5DFikh5TXrW/aOaCvCP8g2MMAfPXo3oeHR9v7dRuAZhu38PUWEkYrL4e9VRTcgZE4yER21AHndgpq2QPTQ==",
       "dev": true,
       "requires": {
         "@types/sizzle": "*"
@@ -9449,9 +9449,9 @@
       "dev": true
     },
     "spica": {
-      "version": "0.0.492",
-      "resolved": "https://registry.npmjs.org/spica/-/spica-0.0.492.tgz",
-      "integrity": "sha512-RRkarcCp/GzdExxZKSgPBMcMMhypt77A4vFunI57yKZ84VF+Wx35kDGhZC09vcDWPMDaCOPVWbEBYCfciEYQCw==",
+      "version": "0.0.494",
+      "resolved": "https://registry.npmjs.org/spica/-/spica-0.0.494.tgz",
+      "integrity": "sha512-QWdBjWGvCfHocwx2RDurOhhDDxs/HfRP33eLRVFoJCWx0UYS12NZhVZfCgD5NosuiOrZrwsIZ1/ppNXxEMlNaQ==",
       "dev": true
     },
     "split-string": {
@@ -10024,9 +10024,9 @@
       "dev": true
     },
     "typed-dom": {
-      "version": "0.0.247",
-      "resolved": "https://registry.npmjs.org/typed-dom/-/typed-dom-0.0.247.tgz",
-      "integrity": "sha512-EmFFA1Ymmu8P+VX6scMr/vp2zbQKbjdmnW00jyoWMofr/eDPtdAQGU/SeyXbF3GYOWAml0fl3WXYCUe+G0gkew==",
+      "version": "0.0.248",
+      "resolved": "https://registry.npmjs.org/typed-dom/-/typed-dom-0.0.248.tgz",
+      "integrity": "sha512-iwOQlPwma7lQipzbsG6wkc0Z8lM2L0pApdRLe8k4/oVPEIT4y5TWyZb+NB14lcXWqL90Hph0dTASuJL/SB31fg==",
       "dev": true
     },
     "typedarray": {
@@ -10045,9 +10045,9 @@
       }
     },
     "typescript": {
-      "version": "4.5.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.5.2.tgz",
-      "integrity": "sha512-5BlMof9H1yGt0P8/WF+wPNw6GfctgGjXp5hkblpyT+8rkASSmkUKMXrxR0Xg8ThVCi/JnHQiKXeBaEwCeQwMFw==",
+      "version": "4.5.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-4.5.3.tgz",
+      "integrity": "sha512-eVYaEHALSt+s9LbvgEv4Ef+Tdq7hBiIZgii12xXJnukryt3pMgJf6aKhoCZ3FWQsu6sydEnkg11fYXLzhLBjeQ==",
       "dev": true
     },
     "ua-parser-js": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "securemark",
-  "version": "0.224.0",
+  "version": "0.224.1",
   "description": "Secure markdown renderer working on browsers for user input data.",
   "private": false,
   "homepage": "https://github.com/falsandtru/securemark",
@@ -30,8 +30,8 @@
     "dompurify": "global:DOMPurify"
   },
   "devDependencies": {
-    "@types/dompurify": "2.3.1",
-    "@types/jquery": "3.5.9",
+    "@types/dompurify": "2.3.2",
+    "@types/jquery": "3.5.10",
     "@types/mathjax": "0.0.37",
     "@types/mocha": "9.0.0",
     "@types/power-assert": "1.5.8",
@@ -56,13 +56,13 @@
     "karma-firefox-launcher": "^2.1.2",
     "karma-mocha": "^2.0.1",
     "mocha": "^9.1.3",
-    "npm-check-updates": "^12.0.2",
+    "npm-check-updates": "^12.0.3",
     "power-assert": "^1.6.1",
     "semver": "^7.3.5",
-    "spica": "0.0.492",
+    "spica": "0.0.494",
     "tsify": "^5.0.4",
-    "typed-dom": "0.0.247",
-    "typescript": "4.5.2",
+    "typed-dom": "0.0.248",
+    "typescript": "4.5.3",
     "vinyl-buffer": "^1.0.1",
     "vinyl-source-stream": "^2.0.0"
   },

package/src/parser/inline/link.test.ts

@@ -51,31 +51,40 @@ describe('Unit: parser/inline/link', () => {
       assert.deepStrictEqual(inspect(parser('[]{  }')), undefined);
       assert.deepStrictEqual(inspect(parser('[]{   }')), undefined);
       assert.deepStrictEqual(inspect(parser('[]{{}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[]{{a}}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[]{a\nb}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[]{a\\\nb}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[]{ a}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[]{ a\n}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[]{{b}}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[]{b\nb}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[]{b\\\nb}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[]{ b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[]{ b\n}')), undefined);
       assert.deepStrictEqual(inspect(parser('[ ]{}')), undefined);
       assert.deepStrictEqual(inspect(parser('[ ]{ }')), undefined);
-      assert.deepStrictEqual(inspect(parser('[ ]{a}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[  ]{a}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[\n]{}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[\\ ]{}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[\\\n]{}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[[]{}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[]]{}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[ ]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[  ]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[\n]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[\\ ]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[\\\n]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[	]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[[]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[]]{b}')), undefined);
       assert.deepStrictEqual(inspect(parser('[a]{}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[a\nb]{#}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[a\\\nb]{#}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[<wbr>]{/}')), undefined);
-      assert.deepStrictEqual(inspect(parser('[[# a #]]{#}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[\\ a]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[ \\ a]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[a\nb]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[a\\\nb]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[<wbr>]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[[# a #]]{b}')), undefined);
       assert.deepStrictEqual(inspect(parser('[*a\nb*]{/}')), undefined);
       assert.deepStrictEqual(inspect(parser('[http://host]{http://host}')), undefined);
       assert.deepStrictEqual(inspect(parser('[]{ttp://host}')), [['<a class="invalid">ttp://host</a>'], '']);
       //assert.deepStrictEqual(inspect(parser('[]{http://[::ffff:0:0%1]}')), [['<a class="invalid">http://[::ffff:0:0%1]</a>'], '']);
       //assert.deepStrictEqual(inspect(parser('[]{http://[::ffff:0:0/96]}')), [['<a class="invalid">http://[::ffff:0:0/96]</a>'], '']);
-      assert.deepStrictEqual(inspect(parser(' []{a}')), undefined);
+      assert.deepStrictEqual(inspect(parser('[]{^/.}')), [[`<a class="invalid">^/.</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/..}')), [[`<a class="invalid">^/..</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/../}')), [[`<a class="invalid">^/../</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/../..}')), [[`<a class="invalid">^/../..</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/../b}')), [[`<a class="invalid">^/../b</a>`], '']);
+      assert.deepStrictEqual(inspect(parser('[]{^/../b/..}')), [[`<a class="invalid">^/../b/..</a>`], '']);
+      assert.deepStrictEqual(inspect(parser(' []{b}')), undefined);
       assert.deepStrictEqual(inspect(parser('![]{/}')), undefined);
     });
 
@@ -94,13 +103,6 @@ describe('Unit: parser/inline/link', () => {
       assert.deepStrictEqual(inspect(parser('[]{#b}')), [['<a href="#b">#b</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[]{./b}')), [['<a href="./b">./b</a>'], '']);
       assert.deepStrictEqual(inspect(parser('[]{^/b}')), [[`<a href="/b">^/b</a>`], '']);
-      assert.deepStrictEqual(inspect(parser('[]{^/b/.}')), [[`<a class="invalid">^/b/.</a>`], '']);
-      assert.deepStrictEqual(inspect(parser('[]{^/b/./}')), [[`<a class="invalid">^/b/./</a>`], '']);
-      assert.deepStrictEqual(inspect(parser('[]{^/b/..}')), [[`<a class="invalid">^/b/..</a>`], '']);
-      assert.deepStrictEqual(inspect(parser('[]{^/b/../}')), [[`<a class="invalid">^/b/../</a>`], '']);
-      assert.deepStrictEqual(inspect(parser('[]{^/b/../..}')), [[`<a class="invalid">^/b/../..</a>`], '']);
-      assert.deepStrictEqual(inspect(parser('[]{^/b/../c}')), [[`<a class="invalid">^/b/../c</a>`], '']);
-      assert.deepStrictEqual(inspect(parser('[]{^/b/../c/..}')), [[`<a class="invalid">^/b/../c/..</a>`], '']);
       assert.deepStrictEqual(inspect(parser('[]{^/b?/../}')), [[`<a href="/b?/../">^/b?/../</a>`], '']);
       assert.deepStrictEqual(inspect(parser('[]{^/b#/../}')), [[`<a href="/b#/../">^/b#/../</a>`], '']);
       assert.deepStrictEqual(inspect(parser('[]{^/b}', { host: new URL('/dir', location.origin) })), [[`<a href="/dir/b">^/b</a>`], '']);

package/src/parser/inline/link.ts

@@ -111,9 +111,9 @@ function create(
     case 'https:':
       assert(uri.host);
       if (INSECURE_URI.slice(0, 2) === '^/' &&
-          /(?:\/\.\.?)(?:\/|$)/.test(INSECURE_URI.slice(0, INSECURE_URI.search(/[?#]|$/)))) {
+          /\/\.\.?(?:\/|$)/.test(INSECURE_URI.slice(0, INSECURE_URI.search(/[?#]|$/)))) {
         type = 'argument';
-        description = 'Subresource paths cannot contain dot-segments.';
+        description = 'Dot-segments cannot be used in subresource paths.';
         break;
       }
       return html('a',

package/src/parser/inline/media.test.ts

@@ -29,27 +29,34 @@ describe('Unit: parser/inline/media', () => {
       assert.deepStrictEqual(inspect(parser('![]{   }')), undefined);
       assert.deepStrictEqual(inspect(parser('![]]{/}')), undefined);
       assert.deepStrictEqual(inspect(parser('![]{{}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{{a}}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{a\nb}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{a\\\nb}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{ a}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![]{ a\n}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![ ]{#}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![  ]{#}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![\\ ]{#}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![	]{#}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{{b}}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{b\nc}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{a\\\nc}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{ b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{ b\n}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![ ]{}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![ ]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![  ]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![\n]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![\\ ]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![\\\n]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![	]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![[]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![]]{b}')), undefined);
       assert.deepStrictEqual(inspect(parser('![a]{}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![\\ a ]{#}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![ \\ a ]{#}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![a\nb]{#}')), undefined);
-      assert.deepStrictEqual(inspect(parser('![a\\\nb]{#}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![\\ a ]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![ \\ a ]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![a\nb]{b}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![a\\\nb]{b}')), undefined);
       assert.deepStrictEqual(inspect(parser('![]{ttp://host}')), [['<img class="media invalid" data-src="ttp://host" alt="">'], '']);
       assert.deepStrictEqual(inspect(parser('![]{tel:1234567890}')), [['<img class="media invalid" data-src="tel:1234567890" alt="">'], '']);
       //assert.deepStrictEqual(inspect(parser('![]{http://[::ffff:0:0%1]}')), [['<img class="media invalid" alt="">'], '']);
       //assert.deepStrictEqual(inspect(parser('![]{http://[::ffff:0:0/96]}')), [['<img class="media invalid" alt="">'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{./a}')), [['<img class="media invalid" data-src="./a" alt="">'], '']);
-      assert.deepStrictEqual(inspect(parser('![]{../a}')), [['<img class="media invalid" data-src="../a" alt="">'], '']);
-      assert.deepStrictEqual(inspect(parser(' ![]{a}')), undefined);
+      assert.deepStrictEqual(inspect(parser('![]{.}')), [['<img class="media invalid" data-src="." alt="">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{..}')), [['<img class="media invalid" data-src=".." alt="">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{../}')), [['<img class="media invalid" data-src="../" alt="">'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{/../b}')), [['<img class="media invalid" data-src="/../b" alt="">'], '']);
+      assert.deepStrictEqual(inspect(parser(' ![]{b}')), undefined);
       assert.deepStrictEqual(inspect(parser('[]{/}')), undefined);
     });
 
@@ -62,6 +69,8 @@ describe('Unit: parser/inline/media', () => {
       assert.deepStrictEqual(inspect(parser('![]{\\}')), [['<a href="\\" target="_blank"><img class="media" data-src="\\" alt=""></a>'], '']);
       assert.deepStrictEqual(inspect(parser('![]{\\ }')), [['<a href="\\" target="_blank"><img class="media" data-src="\\" alt=""></a>'], '']);
       assert.deepStrictEqual(inspect(parser('![]{\\b}')), [['<a href="\\b" target="_blank"><img class="media" data-src="\\b" alt=""></a>'], '']);
+      assert.deepStrictEqual(inspect(parser('![]{?/../}')), [[`<a href="?/../" target="_blank"><img class="media" data-src="?/../" alt=""></a>`], '']);
+      assert.deepStrictEqual(inspect(parser('![]{#/../}')), [[`<a href="#/../" target="_blank"><img class="media" data-src="#/../" alt=""></a>`], '']);
       assert.deepStrictEqual(inspect(parser('![]{^/b}')), [[`<a href="/b" target="_blank"><img class="media" data-src="/b" alt=""></a>`], '']);
       assert.deepStrictEqual(inspect(parser('![ a]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="a"></a>'], '']);
       assert.deepStrictEqual(inspect(parser('![ a ]{b}')), [['<a href="b" target="_blank"><img class="media" data-src="b" alt="a"></a>'], '']);

package/src/parser/inline/media.ts

@@ -68,12 +68,12 @@ const option: MediaParser.ParameterParser.OptionParser = union([
 function sanitize(uri: ReadonlyURL, target: HTMLElement): boolean {
   assert(target.tagName === 'IMG');
   assert(!target.matches('.invalid'));
-  if (/^\.\.?\//.test(uri.source)) {
+  if (/\/\.\.?(?:\/|$)/.test('/' + uri.source.slice(0, uri.source.search(/[?#]|$/)))) {
     define(target, {
       class: void target.classList.add('invalid'),
       'data-invalid-syntax': 'media',
       'data-invalid-type': 'argument',
-      'data-invalid-description': 'Relative paths cannot be used with media syntax; Use subresource paths instead.',
+      'data-invalid-description': 'Dot-segments cannot be used in media paths; use subresource paths instead.',
     });
     return false;
   }